In networked computer information systems, the potential impact of a security weakness, even if known, tends to be difficult to evaluate and manage in an accurate and timely fashion. One reason for this typically involves the number and nature of these weaknesses, as well as the number of assets involved. For example, an asset may include embedded software layers and other dependencies which may further complicate security assessment and management. Analysis and management difficulties may be still further compounded by services that involve many different assets with interdependencies between those assets.
The ability to identify, understand and make informed decisions based upon a security risk is one important element of effectively managing the security of a network. For example, this ability allows a network manager to ascertain the risks to the network infrastructure and to assign a priority action for each identified risk. Currently, there are several management tools available to help a network manager identify, analyze and manage risks to a computer information system. For example, one such tool allows a network manager to simulate a network/client relationship based on a Service Level Agreement (SLA) profile, wherein the model allows for the presentation of services and customers, their relationship to network objects and the relationships between the network objects in the form of a graphical asset map. Another such tool allows the service-level characteristics to be displayed in a color-coded chart which represents a list of services and corresponding statuses relative to performance, security, systems, applications and networks.
Unfortunately however, these available tools have several undesirable characteristics. One such characteristic involves the inability of the tools to provide a comprehensive view of the security status. Thus, the tool is only able to provide a limited or incomplete view of the security risks. For example, available resources do not provide the capability to model the complex relationships between assets, services and the information system topology in one consolidated representation. This is undesirable because it makes it difficult for a user to quickly relate a service security risk to a related asset. Another such characteristic involves the type and/or level of the information provided. For example, service status information in a service-level view may be limited to a color-coded iconic view or a list item view that represents only one attribute or aggregated attribute, without presenting lower-level details regarding underlying assets that contribute to the security. Moreover, current tools are not able to differentiate between security metrics, thus leading to difficulties in identifying exactly what an indicator is intended to indicate.
Still yet another such undesirable characteristic involves the inability of the current tools to collect, or present information related to the analysis of assets and security weaknesses. Although these tools support vulnerability analysis, they do not take into account asset interdependence. As such, a failure in a database used by a software application may not appear as a failure in the dependent application.
However, despite the availability of an ever increasing number of security event management systems, there are still no currently available solutions which offer the functionality of risk impact consolidation at the network, service and/or organization level. Moreover, in the area of risk calculation, currently available solutions are further deficient in that they are based on various fixed assumptions which typically include, among others, assumptions relating to network topology (mesh, star, etc.), data (modeling, availability, uncertainty, and type such as qualitative or quantitative), organization type (military, government, business, etc.), and variables (threat, vulnerability, asset value, attack paths).